@nelsonlongxiang/dsh-open-a2a-net 0.6.42 → 0.7.0

package/lib/faces/admin.js

@@ -18,7 +18,8 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { canvasNameReserved as reservedCanvasName, isRemoteMemberRef, validRemoteMemberRef } from "../canvas-store.js";
+import { reminderView } from "../reconciliation-state.js";
+import { canvasNameReserved as reservedCanvasName, isRemoteMemberRef, validRemoteMemberRef, legacyBareMember } from "../canvas-store.js";
 import { qualifiedCanvasId } from "../canvas-id.js";
 import { refreshPeerCard, registerCanvasNotify } from "./canvas-notify.js";
 import { CLI_HANDLE_RE } from "../cli-deposit.js";
@@ -76,6 +77,7 @@ export function registerAdminFaces(webServer, d) {
                         id: String(agent.id),
                         label: sessionLabelOf(agent),
                         team: sessionTeamOf(agent),
+                        memberRef: `${sessionTeamOf(agent)}@${d.ownCanvasFingerprint}`,
                         ...nodeMetadataOf(agent),
                         joined: sessionNodes.has(String(agent.id)),
                         live: true,
@@ -115,6 +117,7 @@ export function registerAdminFaces(webServer, d) {
                         label: `${session}-${id8(id)}`,
                         ...(d.ownerSeatNames[id] !== undefined ? { name: d.ownerSeatNames[id], seatName: d.ownerSeatNames[id] } : {}),
                         team: `${config.team}/${id8(id)}`,
+                        memberRef: `${config.team}/${id8(id)}@${d.ownCanvasFingerprint}`,
                         joined: true,
                         live: false,
                         teams: [...teamMemberships.teamsOf(id)],
@@ -133,6 +136,9 @@ export function registerAdminFaces(webServer, d) {
                     sessions,
                     groups: groupStore.list(),
                     canvas: {
+                        ...d.canvasMigrationState(),
+                        // Raw retained slots are an inspection view, never the effective team member list.
+                        retainedMembers: canvasStore.list().flatMap(name => canvasStore.rawMembersOf(name).filter(id => !canvasStore.membersOf(name).includes(id)).map(id => ({ team: name, member: id, suspended: canvasStore.isSuspended(name, id), records: canvasStore.suspensionOf(name, id) }))),
                         teams: canvasStore.list().map(name => ({
                             name,
                             team: canvasTeamOf(name),
@@ -148,16 +154,17 @@ export function registerAdminFaces(webServer, d) {
                                 const rows = [];
                                 const seenLocal = new Set();
                                 for (const id of canvasStore.membersOf(name)) {
+                                    const legacy = legacyBareMember(id);
                                     if (isRemoteMemberRef(id)) {
                                         const localId = localSessionOfHandle(id);
                                         if (localId !== undefined) {
                                             if (seenLocal.has(localId))
                                                 continue;
                                             seenLocal.add(localId);
-                                            rows.push({ id: localId, team: `${config.team}/${id8(localId)}`, joined: sessionNodes.has(localId) || joinedSessions.has(localId), live: sessionNodes.has(localId) });
+                                            rows.push({ ...(legacy ? { provenance: 'legacy-inferred' } : {}), id: localId, team: `${config.team}/${id8(localId)}`, joined: sessionNodes.has(localId) || joinedSessions.has(localId), live: sessionNodes.has(localId) });
                                             continue;
                                         }
-                                        rows.push({ id, team: id, remote: true, ...(CLI_HANDLE_RE.test(id) ? { cliHome: canvasStore.cliHomeOf(id) ?? null, cliHeld: cliDeposits.directoryRows().some(row => row.team === id), ...(canvasStore.wasCliHomeCleared(id) ? { cliHomeCleared: true } : {}) } : {}) });
+                                        rows.push({ ...(legacy ? { provenance: 'unknown' } : {}), id, team: id, remote: true, ...(CLI_HANDLE_RE.test(id) ? { cliHome: canvasStore.cliHomeOf(id) ?? null, cliHeld: cliDeposits.directoryRows().some(row => row.team === id), ...(canvasStore.wasCliHomeCleared(id) ? { cliHomeCleared: true } : {}) } : {}) });
                                         continue;
                                     }
                                     if (seenLocal.has(id))
@@ -169,7 +176,8 @@ export function registerAdminFaces(webServer, d) {
                             })(),
                         })),
                     },
-                    host: lanIp === '' ? {} : { lanIp },
+                    // #332: home-controlled aliases, never inferred from peer cards or a file reference.
+                    host: { ...(lanIp !== '' ? { lanIp } : {}), originClaimAudiences: [...config.originClaimAudiences ?? []] },
                     // gh#20 W-C (host rail): each peer row also carries its display
                     // name and version from the warm card (absent until a fetch),
                     // and the last-contact timestamp for the health lamp. W-A's
@@ -189,7 +197,7 @@ export function registerAdminFaces(webServer, d) {
                         };
                     }),
                     remote: (refreshRemoteRows(), (d.remoteRowsCache?.rows ?? []).map(row => {
-                        const canvasTeams = canvasStore.teamsOf(row.team);
+                        const canvasTeams = [...new Set([...canvasStore.teamsOf(row.team), ...(row.memberRef ? canvasStore.teamsOf(row.memberRef) : [])])];
                         return canvasTeams.length > 0 ? { ...row, canvasTeams: [...canvasTeams] } : row;
                     })),
                     activity: recentActivity.slice(),
@@ -202,12 +210,19 @@ export function registerAdminFaces(webServer, d) {
                     // in-flight ring cannot show. Dead-lettered rows ride their own
                     // list and settled ones just a count, all additive so the panel
                     // keeps rendering plain owed rows until it learns the tiers.
+                    ledgerPersistence: taskLedger.persistenceState(),
+                    deliveryBookkeeping: taskLedger.deliveryBookkeepingState(),
+                    nudgeEscalations: d.nudgeEscalations?.() ?? { queued: 0, unavailable: 0, failed: 0 },
+                    reconciliationReminders: d.reminderDiagnostics?.(),
                     tasks: taskLedger.list()
                         .filter(task => task.status === 'pending')
                         .map(task => ({
+                        ...reminderView(taskLedger.reminderState(task.taskId)),
                         taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, status: task.status,
                         direction: task.direction ?? 'outbound', receiptExpected: task.receiptExpected !== false,
                         ...(task.answeredAt !== undefined ? { answeredAt: task.answeredAt } : {}),
+                        ...(task.receiptDelivery ? { receiptDelivery: task.receiptDelivery } : {}),
+                        ...(task.consumed !== undefined ? { consumed: task.consumed, deliveryObservation: task.consumed ? 'consumed' : 'delivered-unconsumed' } : {}),
                         ...(task.forwarded === true ? { forwarded: true } : {}),
                         ...(task.deliveredTo !== undefined ? { deliveredTo: task.deliveredTo } : {}),
                         ...(task.receiverMembers !== undefined ? { receiverMembers: task.receiverMembers } : {}),
@@ -229,7 +244,8 @@ export function registerAdminFaces(webServer, d) {
                     tasksStaleCount: taskLedger.list().filter(task => task.status === 'pending' && (task.receiptExpected === false || Date.now() - task.startedAt >= 60 * 60_000)).length,
                     tasksDead: taskLedger.list()
                         .filter(task => task.status === 'dead')
-                        .map(task => ({ taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, deadAt: task.deadAt ?? task.startedAt, reason: task.reason ?? 'unspecified', ...(task.answeredAt !== undefined ? { answeredAt: task.answeredAt } : {}), ...(task.brief !== undefined ? { brief: task.brief } : {}), ...(task.direction !== undefined ? { direction: task.direction } : {}), ...(task.sender !== undefined ? { sender: task.sender } : {}), ...(task.auth !== undefined ? { auth: task.auth } : task.direction === 'inbound' ? { authLegacy: true } : {}) })),
+                        .map(task => ({ taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, deadAt: task.deadAt ?? task.startedAt, reason: task.reason ?? 'unspecified', ...(task.answeredAt !== undefined ? { answeredAt: task.answeredAt } : {}),
+                        ...(task.receiptDelivery ? { receiptDelivery: task.receiptDelivery } : {}), ...(task.brief !== undefined ? { brief: task.brief } : {}), ...(task.direction !== undefined ? { direction: task.direction } : {}), ...(task.sender !== undefined ? { sender: task.sender } : {}), ...(task.auth !== undefined ? { auth: task.auth } : task.direction === 'inbound' ? { authLegacy: true } : {}) })),
                     // gh#31: per-task outcomes for rows that LEFT the ledger — the
                     // chat drawer used to guess (settled, abandoned or cancelled).
                     // Bounded to the archive (≤64), newest first, with the
@@ -248,6 +264,7 @@ export function registerAdminFaces(webServer, d) {
                     // its direction when known.
                     archived: taskLedger.archive().slice(0, ARCHIVE_CAP).map(row => ({
                         taskId: row.taskId,
+                        ...(row.withdrawalResult ? { withdrawalResult: row.withdrawalResult } : {}),
                         team: row.team,
                         peer: row.peer,
                         startedAt: row.startedAt,
@@ -340,6 +357,9 @@ export function registerAdminFaces(webServer, d) {
                     boundMissInbound: d.boundMissInboundCount,
                     // Who missed, by verified caller and the origin it dialled (newest first, ≤16).
                     boundMissRecent: d.boundMissRecent,
+                    // Present-but-unverifiable envelopes by claimed caller and reason (bad-ts = sender clock skew > ±5 min).
+                    claimRejectsInbound: d.claimRejectsInboundCount,
+                    claimRejectsRecent: d.claimRejectsRecent,
                     // gh#113: CLI mailbox loss, all handles — mail the 64-row cap
                     // pushed out, and mail cut at 4000 chars. The team verifier
                     // holds `dropped` to zero.
@@ -445,7 +465,16 @@ export function registerAdminFaces(webServer, d) {
             readJsonBody(req, res, (body) => {
                 const id = typeof body.id === 'string' ? body.id : '';
                 // gh#131: read while the session is still joined — its own handle reads as it only then.
-                const ownHandle = id !== '' ? ownCanvasHandleOf(id) : undefined;
+                try {
+                    if (id !== '')
+                        d.revokeCanvasMember(id, 'leave');
+                }
+                catch (error) {
+                    const payload = JSON.stringify({ ok: false, error: String(error) });
+                    res.writeHead(503, { 'Content-Type': 'application/json' });
+                    res.end(payload);
+                    return;
+                }
                 if (id !== '')
                     sessionNodes.delete(id);
                 joinedSessions.remove(id);
@@ -453,9 +482,6 @@ export function registerAdminFaces(webServer, d) {
                 // without join consent would be a routing backdoor. Team
                 // roster declarations die the same way (S2 consistency) — and so
                 // does a membership a fleet edit stored by the session's handle.
-                canvasStore.dropMember(id);
-                if (ownHandle !== undefined)
-                    canvasStore.dropMember(ownHandle);
                 teamMemberships.dropSession(id);
                 const payload = JSON.stringify({ id });
                 res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
@@ -517,7 +543,7 @@ export function registerAdminFaces(webServer, d) {
         path: '/__dsh_a2a/fleet-canvas-op',
         handler: controlRoute((req, res) => {
             readJsonBody(req, res, async (body) => {
-                const { peer, op, name, id } = body;
+                const { peer, op, name, id, memberPeer } = body;
                 const peerUrl = typeof peer === 'string' ? peer : '';
                 const opV = typeof op === 'string' ? op : '';
                 const nameV = typeof name === 'string' ? name : '';
@@ -536,7 +562,13 @@ export function registerAdminFaces(webServer, d) {
                 }
                 try {
                     const target = peerUrl.replace(/\/$/, '') + '/a2a/canvas-op';
-                    const body = JSON.stringify({ op: opV, name: nameV, ...(opV === 'add-member' || opV === 'remove-member' ? { id: idV !== '' && !isRemoteMemberRef(idV) && (sessionNodes.has(idV) || joinedSessions.has(idV)) ? `${config.team}/${id8(idV)}` : idV } : {}) });
+                    const proof = opV === 'add-member' ? await d.canvasMemberForWrite(idV, memberPeer) : undefined;
+                    if (proof && !proof.ok) {
+                        send(JSON.stringify(proof));
+                        return;
+                    }
+                    const selectedId = proof?.ok ? (proof.member.includes('/') ? proof.member : `${config.team}/${id8(proof.member)}@${d.ownCanvasFingerprint}`) : idV !== '' && !isRemoteMemberRef(idV) && (sessionNodes.has(idV) || joinedSessions.has(idV)) ? `${config.team}/${id8(idV)}@${d.ownCanvasFingerprint}` : idV;
+                    const body = JSON.stringify({ op: opV, name: nameV, ...(opV === 'add-member' || opV === 'remove-member' ? { id: selectedId } : {}) });
                     const reply = await d.peerFetch(target, {
                         method: 'POST',
                         headers: { 'Content-Type': 'application/json', ...originClaimHeaders({ url: target, method: 'POST', body }) },
@@ -545,6 +577,12 @@ export function registerAdminFaces(webServer, d) {
                         body,
                         signal: AbortSignal.timeout(15_000),
                     });
+                    // #320: a JSON body cannot turn a failed/redirected HTTP operation into success.
+                    if (!reply.ok || reply.status < 200 || reply.status >= 300) {
+                        void reply.body?.cancel().catch(() => { });
+                        send(JSON.stringify({ ok: false, status: reply.status, error: `peer ${peerUrl} answered HTTP ${String(reply.status)} — fleet canvas operation failed` }));
+                        return;
+                    }
                     const raw = await reply.text();
                     try {
                         const out = JSON.parse(raw);
@@ -738,72 +776,117 @@ export function registerAdminFaces(webServer, d) {
             readJsonBody(req, res, async (body) => {
                 const action = body.action;
                 let payload;
-                if (action === 'cli-home-options') {
-                    const name = typeof body.name === 'string' ? body.name : '';
-                    const id = typeof body.id === 'string' ? body.id : '';
-                    if (!CLI_HANDLE_RE.test(id) || !canvasStore.membersOf(name).includes(id))
-                        payload = JSON.stringify({ ok: false, error: 'an existing canvas CLI member is required' });
-                    else {
-                        try {
-                            payload = JSON.stringify({ ok: true, ...await d.cliHomeOptions(id) });
-                        }
-                        catch {
-                            payload = JSON.stringify({ ok: false, error: 'fresh home card lookup failed' });
+                try {
+                    if (action === 'confirm-member') {
+                        const name = typeof body.name === 'string' ? body.name : '', id = typeof body.id === 'string' ? body.id : '';
+                        const request = body;
+                        const replacement = typeof request.replacement === 'string' ? request.replacement : '';
+                        const originalHandle = id.replace(/@[0-9a-f]{8}$/, '');
+                        const localChoice = replacement !== '' && !replacement.includes('/');
+                        const proof = localChoice && originalHandle !== `${config.team}/${id8(replacement)}` ? { ok: false, error: 'local confirmation must match this host zone and the original handle' } : await d.canvasMemberForWrite(replacement, request.peer);
+                        const out = proof.ok ? canvasStore.confirmMember(name, id, proof.member, proof.ownerKey, request.revision, request.expectedOwner) : proof;
+                        logger.info('canvas provenance owner confirmation actor=owner-control at=%s team=%s old=%s new=%s ownerKey=%s ok=%s', new Date().toISOString(), name, id, proof.ok ? proof.member : replacement, proof.ok ? proof.ownerKey ?? 'local-id' : 'unconfirmed', out.ok);
+                        payload = JSON.stringify({ ...out, ...canvasStore.state() });
+                    }
+                    else if (action === 'restore-suspended' || action === 'delete-suspended') {
+                        const request = body;
+                        const name = typeof request.name === 'string' ? request.name : '', id = typeof request.id === 'string' ? request.id : '';
+                        const out = canvasStore.regulateSuspended(action === 'restore-suspended' ? 'restore' : 'delete', name, id, request.revision, request.expected);
+                        logger.info('canvas suspended owner operation %s %s %s: %s', action, name, id, out.ok);
+                        payload = JSON.stringify({ ...out, ...canvasStore.state() });
+                    }
+                    else if (action === 'cli-home-options') {
+                        const name = typeof body.name === 'string' ? body.name : '';
+                        const id = typeof body.id === 'string' ? body.id : '';
+                        if (!CLI_HANDLE_RE.test(id) || !canvasStore.membersOf(name).includes(id))
+                            payload = JSON.stringify({ ok: false, error: 'an existing canvas CLI member is required' });
+                        else {
+                            try {
+                                payload = JSON.stringify({ ok: true, ...await d.cliHomeOptions(id) });
+                            }
+                            catch {
+                                payload = JSON.stringify({ ok: false, error: 'fresh home card lookup failed' });
+                            }
                         }
                     }
-                }
-                else if (action === 'create') {
-                    const name = typeof body.name === 'string' ? body.name : '';
-                    const stored = canvasNameReserved(name) ? undefined : canvasStore.create(name);
-                    payload = JSON.stringify(stored === undefined ? { ok: false, error: 'invalid, roster-reserved name or team cap reached' } : { ok: true, name: stored, teams: canvasStore.list() });
-                }
-                else if (action === 'remove') {
-                    const name = typeof body.name === 'string' ? body.name : '';
-                    payload = JSON.stringify({ ok: canvasStore.remove(name), teams: canvasStore.list() });
-                }
-                else if (action === 'add-member') {
-                    const name = typeof body.name === 'string' ? body.name : '';
-                    const id = typeof body.id === 'string' ? body.id : '';
-                    // Dual member shape: a local session id must be a joined node;
-                    // a remote ref is a zone-qualified team handle whose shape this
-                    // gate checks and whose existence the UI picker (directory
-                    // rows) vouches for. Humans compose both via the workbench.
-                    const memberValid = isRemoteMemberRef(id)
-                        ? validRemoteMemberRef(id)
-                        : id !== '' && (sessionNodes.has(id) || joinedSessions.has(id));
-                    if (!canvasStore.hasTeam(name) && canvasNameReserved(name)) {
-                        payload = JSON.stringify({ ok: false, error: 'roster reserves this canvas name' });
+                    else if (action === 'create') {
+                        const name = typeof body.name === 'string' ? body.name : '';
+                        const stored = canvasNameReserved(name) ? undefined : canvasStore.create(name);
+                        payload = JSON.stringify(stored === undefined ? { ok: false, error: 'invalid, roster-reserved name or team cap reached' } : { ok: true, name: stored, teams: canvasStore.list() });
                     }
-                    else if (name === '' || !memberValid) {
-                        payload = JSON.stringify({ ok: false, error: 'name and a member (joined session id, or a zone-qualified remote team handle like zone/a1b2c3d4) are required' });
+                    else if (action === 'remove') {
+                        const name = typeof body.name === 'string' ? body.name : '';
+                        payload = JSON.stringify({ ok: canvasStore.remove(name), teams: canvasStore.list() });
                     }
-                    else {
-                        const pin = await d.cliHomeForAdd(id, body.home).catch(() => ({ ok: false, error: 'linked home card lookup failed' }));
-                        if (!pin.ok)
-                            payload = JSON.stringify({ ok: false, error: pin.error });
+                    else if (action === 'add-member') {
+                        const name = typeof body.name === 'string' ? body.name : '';
+                        const id = typeof body.id === 'string' ? body.id : '';
+                        // Dual member shape: a local session id must be a joined node;
+                        // a remote ref is a zone-qualified team handle whose shape this
+                        // gate checks and whose existence the UI picker (directory
+                        // rows) vouches for. Humans compose both via the workbench.
+                        const memberValid = isRemoteMemberRef(id)
+                            ? validRemoteMemberRef(id)
+                            : id !== '' && (sessionNodes.has(id) || joinedSessions.has(id));
+                        if (!canvasStore.hasTeam(name) && canvasNameReserved(name)) {
+                            payload = JSON.stringify({ ok: false, error: 'roster reserves this canvas name' });
+                        }
+                        else if (name === '' || !memberValid) {
+                            payload = JSON.stringify({ ok: false, error: 'name and a member (joined session id, or a zone-qualified remote team handle like zone/a1b2c3d4) are required' });
+                        }
+                        else if (legacyBareMember(id) && canvasStore.rawMembersOf(name).includes(id)) {
+                            // Re-adding a retained legacy slot is a no-op, never provenance confirmation or restore.
+                            payload = JSON.stringify({ ok: true, members: canvasStore.membersOf(name), provenance: 'unknown' });
+                        }
                         else {
-                            canvasStore.create(name);
-                            const explicitHome = body.home !== undefined;
-                            const home = explicitHome ? pin.home : canvasStore.cliHomeOf(id) ?? pin.home;
-                            payload = JSON.stringify({ ok: canvasStore.addMember(name, id, home, { replaceHome: explicitHome }), teams: canvasStore.list(), members: canvasStore.membersOf(name) });
+                            const proof = await d.canvasMemberForWrite(id, body.peer);
+                            if (!proof.ok) {
+                                payload = JSON.stringify(proof);
+                                res.writeHead(200, { 'Content-Type': 'application/json' });
+                                res.end(payload);
+                                return;
+                            }
+                            const pin = await d.cliHomeForAdd(proof.member, body.home).catch(() => ({ ok: false, error: 'linked home card lookup failed' }));
+                            if (!pin.ok)
+                                payload = JSON.stringify({ ok: false, error: pin.error });
+                            else {
+                                canvasStore.create(name);
+                                const explicitHome = body.home !== undefined;
+                                const home = explicitHome ? pin.home : canvasStore.cliHomeOf(id) ?? pin.home;
+                                payload = JSON.stringify({ ok: canvasStore.addMember(name, proof.member, home, { replaceHome: explicitHome, ownerKey: proof.ownerKey }), teams: canvasStore.list(), members: canvasStore.membersOf(name) });
+                            }
                         }
                     }
-                }
-                else if (action === 'remove-member') {
-                    const name = typeof body.name === 'string' ? body.name : '';
-                    const id = typeof body.id === 'string' ? body.id : '';
-                    if (name === '' || id === '') {
-                        payload = JSON.stringify({ ok: false, error: 'name and id are required' });
+                    else if (action === 'remove-member') {
+                        const name = typeof body.name === 'string' ? body.name : '';
+                        const id = typeof body.id === 'string' ? body.id : '';
+                        if (name === '' || id === '') {
+                            payload = JSON.stringify({ ok: false, error: 'name and id are required' });
+                        }
+                        else {
+                            // gh#131: removing a local session removes its handle-stored slot too.
+                            let removed = false;
+                            try {
+                                removed = isRemoteMemberRef(id) ? (!canvasStore.isSuspended(name, id) && canvasStore.removeMember(name, id)) : d.revokeCanvasMember(id, 'remove', name);
+                            }
+                            catch (error) {
+                                payload = JSON.stringify({ ok: false, error: String(error) });
+                                res.writeHead(503, { 'Content-Type': 'application/json' });
+                                res.end(payload);
+                                return;
+                            }
+                            payload = JSON.stringify({ ok: removed, teams: canvasStore.list(), members: canvasStore.membersOf(name) });
+                        }
                     }
                     else {
-                        // gh#131: removing a local session removes its handle-stored slot too.
-                        const ownHandle = isRemoteMemberRef(id) ? undefined : ownCanvasHandleOf(id);
-                        const removed = [id, ...(ownHandle !== undefined ? [ownHandle] : [])].map(each => canvasStore.removeMember(name, each)).some(Boolean);
-                        payload = JSON.stringify({ ok: removed, teams: canvasStore.list(), members: canvasStore.membersOf(name) });
+                        payload = JSON.stringify({ ok: false, error: 'unknown action' });
                     }
                 }
-                else {
-                    payload = JSON.stringify({ ok: false, error: 'unknown action' });
+                catch (error) {
+                    const failure = JSON.stringify({ ok: false, error: String(error) });
+                    res.writeHead(503, { 'Content-Type': 'application/json' });
+                    res.end(failure);
+                    return;
                 }
                 res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
                 res.end(payload);

package/lib/faces/files.js

@@ -1,6 +1,7 @@
 import { BLOB_FILE_MAX } from "../blob-store.js";
 import { isRootOriginUrl } from "../origin-claim.js";
 import { claimCovers } from "../task-auth.js";
+import { splitQualifiedMember } from "../canvas-member.js";
 /** Pulls per proven signer (host zone or CLI handle) in a sliding minute (design §8; the FloodGuard figure). */
 export const BLOB_PULLS_PER_MINUTE = 16;
 /** Distinct signers the pull limiter remembers; a full table refuses new signers rather than forgetting live ones. */
@@ -91,7 +92,7 @@ export function registerFileFaces(webServer, d) {
                 refuse(403, 'untrusted-origin', 'the envelope does not prove this caller (it must be the audience-bound form, signed from a root card URL whose zone covers caller_session)');
                 return;
             }
-            const grant = blobStore.list().find(g => g.sha256 === sha256 && grantAdmits(g.to, caller, claim.caller, config.team, name => canvasStore.membersOf(name), claim.cli === true));
+            const grant = blobStore.list().find(g => g.sha256 === sha256 && grantAdmits(g.to, caller, claim.caller, config.team, name => canvasStore.membersOf(name).flatMap(ref => { const member = splitQualifiedMember(ref); return member ? (canvasStore.ownerKeyOf?.(ref) === claim.card.publicKey ? [member.handle] : []) : [ref]; }), claim.cli === true));
             // One answer for "no such blob", "expired" and "not yours": a refusal is no existence oracle.
             if (grant === undefined) {
                 refuse(403, 'not-granted', 'no live grant lets this caller pull that file');